Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

Recommendation 14: Incentivize contractor compliance and manage risk 

efficiently through robust risk assessment.

Problem

DCAA uses a simple risk assessment to prioritize workload. Because DCAA bears all oversight 

responsibilities regarding contractor costs and related business systems, and it will be affected by 

recommended oversight time limits. DCAA needs a more robust risk assessment approach. 

Background

DCAA plays an important role within DoD’s system of acquisition internal controls. When these 

controls are operating effectively and efficiently, they provide DoD reasonable assurance that contract 

prices and cost reimbursements are free of material unallowable costs. This concept, established by the 

COSO Internal Control Framework and incorporated into the GAO’s Standards for Internal Control in 

the Federal Government (i.e., Green Book), is fully compatible with the FAR guiding principle of shifting 

focus from risk avoidance to risk management.

1 To accomplish the desired outcome of both the federal 

government’s internal control framework and the FAR’s Guiding Principles, DCAA must embrace a 

more insightful risk assessment process.

Findings

DCAA has made progress in the last 7 years to better focus the agency’s resources based on risk. 

Currently, the agency uses Auditable Dollar Volume (ADV) as its primary risk consideration to 

determine which contractors’ costs will be subject to oversight.2 With the recommended expansion of 

the types of oversight tools available in DCAA’s toolbox (see Recommendation 7), the agency will no 

longer need to perform full-scope financial statement-like audits as its only means to deliver 

information and assurance to contracting officers. The oversight agility provided by a wider variety of 

oversight tools necessitates a more insightful view of contractor cost risk. Although ADV is an 

important measure of potential risk—arguably the most important—consideration of other important 

risk measures will help DCAA better focus its resources on the contractors and cost areas that present 

meaningful risk to DoD.

Contractors whose final indirect cost rate proposals exceed DCAA’s high risk ADV threshold 

(i.e., $250 million) cannot reduce their risk profile to anything less than high risk due to DCAA’s 

limited risk assessment processes.3 Defense contractors should have the opportunity to reduce their 

risk profile by demonstrating their commitment to consistent compliance through their own robust 

systems of internal control. This is precisely the objective of DoD’s system of acquisition internal 

controls.

In the late 1980s, DoD and contractors worked together to create the Contractor Risk Assessment Guide 

(CRAG) Program with the intent of contractors implementing and monitoring systems of internal 

 

1 Performance Standards, FAR 1.102-2(c)(2). 2 DoD, Defense Contract Audit Agency Memorandum 12-PPD-023(R), Audit Guidance on Revised Policy and Procedures for Sampling LowRisk Incurred Cost Proposals, dated September 6, 2012, accessed November 20, 2017, 

https://www.dcaa.mil/Content/Documents/MMR/12-PPD-023.pdf. 3 Ibid.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

control to improve contract cost compliance.4 Improved contractor internal controls ideally yield more 

effective government oversight. Some participating contractors still did not experience reduced 

oversight despite demonstrated improvements in compliance during the CRAG program,

5 although the 

program is no longer even active.

Conclusions

It is unclear why DoD’s oversight has not changed when contractors invest in stronger systems of 

internal control; however, a clear path to that desired outcome is needed. With a refocused mission, 

oversight time limits, more tools in the oversight professional’s toolbox, and more robust risk 

assessments, DCAA can become more effective and efficient.

DoD should implement a risk assessment approach whereby weightings are assigned to a variety of 

fact-based risk considerations. Risk weights, based on objective criteria aligned with low, medium, and 

high risk classifications, are assigned for each risk consideration. See Table 2-7 for proposed risk 

considerations and potential objective criteria for each risk classification. 

Table 2-7. Risk Assessment Matrix

Risk Considerations

Low Risk Score = 1 

(unless otherwise 

noted)

Medium Risk Score 

=2

High Risk Score =3 

(unless otherwise 

noted)

Total Auditable Dollar Volume (ADV) Less than $50m (0 

for less than $15m)

Between $50m250mOver $250m (4 for 

more than $500m; 

5 for more than

$1.0b)

Cost reimbursable direct and indirect costs

Total ADV as a % of business unit total

costs

Less than 20% (0 for 

less than 10%)

Between 20%- 60% More than 60%

(4 for more than

80%)

Overall Government Participation in 

Indirect Costs

Less than 20% Between 20%- 60% More than 60%

% of indirect costs allocable to costreimbursable contracts from indirect cost 

pools in which the government participates

Highest Participation among all allocable 

Indirect Cost Pools

Less than 20% Between 20%- 60% More than 60%

% of indirect costs allocable to costreimbursable contracts from the indirect 

cost pool with the highest government 

participation

 

4 Department of Defense, The DoD Contractor Risk Assessment Guide (AD-A203 565). 5 U.S. Congress, Office of Technology Assessment, Building Future Security, OTA-ISC-530, accessed December 29, 2017, 

https://www.ota.fas.org/reports/9205.pdf.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

Risk Considerations

Low Risk Score = 1 

(unless otherwise 

noted)

Medium Risk Score 

=2

High Risk Score =3 

(unless otherwise 

noted)

Number of Final Indirect Cost Rates 

Applicable to Government Contracts

Less than 4 Between 4-8 More than 8

Number of Intermediate Cost Pools Less than 4 Between 4-8 More than 8

Net Annual Indirect Cost True-up Less than 1% Between 1% and 3% More than 3%

Most-recently closed contractor fiscal year 

– Total true-up amount (provisionally-billed 

vs. proposed final) as a percent of total 

final proposed indirect costs

Adequacy of Final Indirect Cost Rate 

Proposals

All required in last 3 

years

More than 50% in 

last 3 years

Less than 50% in last 

3 years

Cost Accounting Practice Changes None Less than 2 More than 1

Most-recently closed Fiscal Year, as 

reported on Schedule M; exclude 

organizational changes and adoption of 

new practices

Prior Fiscal Year Sustained Questioned 

Costs

Less than 1% or N/A Between 1% and 3% More than 3%

Net impact to cost-reimbursable contracts 

of questioned costs agreed upon or 

accepted by the contracting officer

Business Unit CAS-Covered Contracts Neither (Small 

Business = 0)

Modified coverage Full coverage or 

both

Modified Coverage, Full Coverage, Neither, 

or Both

Accounting System Status Approved with no 

significant 

deficiencies

Approved w/ one or 

more significant 

deficiencies or not 

evaluated

Disapproved 

(i.e., one or more 

material 

weaknesses)

Within last three contractor fiscal years

These recommended risk considerations provide meaningful insight into contractors’ business and 

contract profiles, how much the government participates in indirect cost pools, the complexity of a 

contractors’ indirect cost structure, the status of contractors’ business systems, and whether contractors 

must comply with CAS, among other things.

The sum of all risk weightings for a particular contractor business unit (as determined by the contractor 

organization responsible for submitting an annual final indirect cost rate proposal), should be used to 

make an initial objective determination of that business unit’s overall risk profile.
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

§ High risk business units should be subject to the most robust oversight, which may include the 

broadest scope and the oversight agency’s highest level of assurance. High risk contractor 

business units will have an overall risk score greater than 30.

§ Medium risk business units will be subject to oversight in targeted areas (i.e., cost items that 

represent the most significant cost risk to the department). The agency may not need to perform 

oversight on all contractor cost representations if prior oversight activities demonstrate a high 

degree of contractor compliance. Medium risk contractor business units will have an overall 

risk score between 25 and 30.

§ Low risk business units will be subject to periodic oversight pursuant to DCAA’s current low 

risk sampling approach. Low risk contractor business units will have an overall risk score less 

than 25.

The table below illustrates the level of oversight for each of the above risk categories. Most small 

businesses would receive a low risk score, and thus receive the most-targeted and least burdensome 

oversight.

Table 2-8. Examples of Envisioned Oversight Levels by Risk Category

Contractor Submission Low Risk Medium Risk High Risk

Final Indirect Cost Rate 

Proposal

May be selected for 

analysis on a sample 

basis. Analysis limited to 

material indirect cost 

accounts that may 

contain unallowable 

costs, or other 

procedures designed to 

address potential 

material indirect cost 

allocation risks

May be selected for 

limited-scope audit on a 

sample basis. Audit 

procedures limited to 

material indirect cost 

accounts and evaluation 

of cost allocation bases 

with over 50 percent

government participation

Full-scope audit of 

material indirect costs, as 

well as the completeness 

and accuracy of cost 

allocation bases.

Forward Pricing Rate Proposal Analyze historical trends 

and review of contractor 

explanation for material 

rate changes

Analyze historical trends 

and year-over-year 

variances in material 

indirect cost elements

Analyze historical trends, 

year-over-year cost 

variances, and evaluate 

bases of estimates for 

material cost elements 

and business volume

This risk assessment process will allow certain otherwise high-risk business units (in terms of ADV) to 

migrate into medium-risk with strong past performance and sound accounting system internal 

controls. Conversely, otherwise low-risk business units may migrate into medium or high risk with 

poor prior compliance history, poor internal controls, and overly complex cost accounting structures 

relative to their size. As shown in Table 2-9, 81 percent of DoD’s contractors that are required to submit 

final indirect cost proposals have an ADV of less than $15 million and will generally receive a low risk 

score, and thus receive the most targeted and least burdensome oversight (see Table 2-9).
Report of the Advisory Panel on Streamlining and Codifying Acquisition Regulations

Volume 1 of 3 | January 2018

Contract Compliance and Audit Volume 1

Table 2-9. CFY 2016 Incurred Cost Proposals Auditable Dollar Value (ADV) Strata6

ADV Strata Contractors Total ADV ($000) Percent Total ADV $

$1 to $15M 2,961 81.0% $ 9,172,162 5.8%

$15M to $100M 525 14.4% $ 23,103,974 14.6%

> $100M 154 4.2% $ 52,334,571 33.1%

> $1B 17 0.5% $ 73,684,447 46.5%

Total 3,657 100.0% $ 158,295,154 100.0%

All of the data necessary for the risk considerations exist within a contractor business unit’s final 

indirect cost rate proposal, or are otherwise readily available. To facilitate consistent, reliable datagathering across all contractors, a new summary schedule should be added to each required Final 

Indirect Cost Rate Proposal (FAR 52.216-7(d)) to assist DCAA with capturing this necessary 

information. DCAA should share its annual risk assessments with contractor business units, upon their 

request, to ensure the agency’s data are accurate and to create transparency.

Implementation

Legislative Branch

§ No statutory changes are required.

Executive Branch

§ DoD should implement a risk assessment approach. 

§ In accordance with the statutory requirements of DoD and the Section 809 Panel, and as set 

forth in Section 803 of the FY 2018 NDAA, the Section 809 Panel will deliberate on the draft risk 

matrix shown in Table 2-7 and provide definitive recommendations prior to the sunset of the 

panel in January 2019.

Implications for Other Agencies

§ There are no cross-agency implications for this recommendation.

 

6 DCAA, emails to the Section 809 Panel staff, September8, 2017 and September 17, 2017.